CVE-2026-47737

HIGHPre-NVD 7.57.5
EchelonGraph scoreLOW confidence

This high-severity CVE scores 7.5 under the CNA's CVSS (NVD's own analysis pending). EPSS exploit probability: 0.0%, top 97% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).

Triggered by: NVD CVSS baseline
Sources: cna:github_m, epss
7.5
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS: 0%CVSS: 7.5Exploit: NoneExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections

Impact

Puma is vulnerable to source IP spoofing when set_remote_address proxy_protocol: :v1 is enabled and persistent connections are used.

PROXY protocol v1 is a connection-level protocol. Support was added to Puma in v5.5.0. A proxy sends one PROXY header at the beginning of a TCP connection, before any HTTP data. Puma incorrectly re-parsed PROXY protocol headers after each keep-alive request on the same connection. An attacker able to send HTTP requests through a trusted proxy could therefore inject a second PROXY header between HTTP requests. Puma would treat the injected header as authoritative for the next request and overwrite REMOTE_ADDR.

This can mislead applications or middleware that use REMOTE_ADDR for security decisions, rate limiting, auditing, or allow/deny lists.

Only deployments that explicitly enable PROXY protocol v1 are affected, and will have set:

set_remote_address proxy_protocol: :v1

Puma's default configuration is not affected. Deployments that do not use persistent connections to Puma are also not expected to be affected by this issue.

Patches

Users should upgrade to versions 7.2.1 or 8.0.2.

Workarounds

Disable PROXY protocol v1 parsing if it is not required:

# remove/comment this:
   # set_remote_address proxy_protocol: :v1

Users can also disable persistent connections to Puma, for example:

enable_keep_alives false

References

CVSS v3
7.5
EG Score
7.5(low)
EPSS
3.0%
KEV
Not listed

Published

June 9, 2026

Last Modified

June 9, 2026

Vendor Advisories for CVE-2026-47737(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Affected Packages

(1 across 1 ecosystem)
RubyGems(1)
PackageVulnerable rangeFixed inDependents
puma5.5.0 ... 7.2.0 (37 versions)7.2.1—

Data Freshness Timeline

(refreshed 11× in last 7d / 57× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-07-05 15:59 UTCEG score recompute
  2. 2026-07-05 02:54 UTCEG score recompute
  3. 2026-07-04 14:35 UTCEG score recompute
  4. 2026-07-03 20:38 UTCEG score recompute
  5. 2026-07-03 09:11 UTCEG score recompute
  6. 2026-07-02 18:10 UTCEG score recompute
  7. 2026-07-02 06:16 UTCEG score recompute
  8. 2026-07-01 18:33 UTCEG score recompute
  9. 2026-07-01 07:08 UTCEG score recompute
  10. 2026-06-30 19:43 UTCEG score recompute
  11. 2026-06-30 08:16 UTCEG score recompute
  12. 2026-06-29 20:52 UTCEG score recompute
  13. 2026-06-29 09:21 UTCEG score recompute
  14. 2026-06-28 21:56 UTCEG score recompute
  15. 2026-06-28 10:31 UTCEG score recompute
  16. 2026-06-27 23:01 UTCEG score recompute
  17. 2026-06-27 11:36 UTCEG score recompute
  18. 2026-06-27 00:07 UTCEG score recompute
  19. 2026-06-26 12:42 UTCEG score recompute
  20. 2026-06-26 01:03 UTCEG score recompute
  21. 2026-06-25 13:33 UTCEG score recompute
  22. 2026-06-25 02:08 UTCEG score recompute
  23. 2026-06-24 14:42 UTCEG score recompute
  24. 2026-06-24 03:17 UTCEG score recompute
  25. 2026-06-23 15:39 UTCEG score recompute
Show 32 more
  1. 2026-06-23 01:07 UTCEG score recompute
  2. 2026-06-22 13:41 UTCEG score recompute
  3. 2026-06-21 19:36 UTCEG score recompute
  4. 2026-06-21 01:57 UTCEG score recompute
  5. 2026-06-20 12:17 UTCEG score recompute
  6. 2026-06-20 00:47 UTCEG score recompute
  7. 2026-06-19 13:14 UTCEG score recompute
  8. 2026-06-19 01:25 UTCEG score recompute
  9. 2026-06-18 13:54 UTCEG score recompute
  10. 2026-06-18 02:12 UTCEG score recompute
  11. 2026-06-17 14:47 UTCEG score recompute
  12. 2026-06-17 03:20 UTCEG score recompute
  13. 2026-06-16 15:56 UTCEG score recompute
  14. 2026-06-16 04:31 UTCEG score recompute
  15. 2026-06-15 16:56 UTCEG score recompute
  16. 2026-06-15 05:31 UTCEG score recompute
  17. 2026-06-14 23:18 UTCEPSS rescore
  18. 2026-06-14 18:06 UTCEG score recompute
  19. 2026-06-14 06:41 UTCEG score recompute
  20. 2026-06-13 23:00 UTCEPSS rescore
  21. 2026-06-13 19:15 UTCEG score recompute
  22. 2026-06-13 07:43 UTCEG score recompute
  23. 2026-06-12 23:12 UTCEPSS rescore
  24. 2026-06-12 20:17 UTCEG score recompute
  25. 2026-06-12 08:52 UTCEG score recompute
  26. 2026-06-11 21:28 UTCEG score recompute
  27. 2026-06-11 10:04 UTCEG score recompute
  28. 2026-06-10 22:38 UTCEG score recompute
  29. 2026-06-10 11:14 UTCEG score recompute
  30. 2026-06-09 23:49 UTCEG score recompute
  31. 2026-06-09 12:25 UTCEG score recompute
  32. 2026-06-09 01:01 UTCEG score recompute

Frequently asked(5)

What is CVE-2026-47737?
CVE-2026-47737 is a high vulnerability published on June 9, 2026. Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections Impact Puma is vulnerable to source IP spoofing when setremoteaddress proxy_protocol: :v1 is enabled and persistent connections are used. PROXY protocol v1 is a connection-level protocol. Support was added to Puma in…
When was CVE-2026-47737 disclosed?
CVE-2026-47737 was first published in the National Vulnerability Database on June 9, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-47737 actively exploited?
CVE-2026-47737 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 3.0% percentile likelihood of exploitation in the next 30 days — higher percentiles indicate greater predicted risk.
What is the CVSS score of CVE-2026-47737?
CVE-2026-47737 has a CVSS v4.0 base score of 7.5 (CNA self-assessment; NVD's own analysis pending). The EG score is currently aggregating — additional source signals are being incorporated as they become available..
How do I remediate CVE-2026-47737?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-47737, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-47737

Explore →

Is Your Infrastructure Affected by CVE-2026-47737?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs